WhatsApping with Los Zetas: Virtual kidnapping in Mexico

Armed with no more than a cell phone and a data package, criminals, far-removed from their targets, are extorting foreign nationals in resort cities across Mexico. For example, in December 2013, a Guatemalan tourist received a threatening phone call from individuals claiming to represent the notorious Los Zetas drug cartel, widely recognised as one of the most violent in Mexico. The callers indicated that they had been following the tourist and instructed her to move to the Parador Hotel in Cancún. Similar calls were made to three other tourists, a US Marine and a Mexican couple. The criminals manipulated the Guatemalan national into unwittingly posing as a Los Zetas associate and forced the other victims into handing over personal information and relatives’ contact details, which helped the kidnappers target their ransom demands. Police investigations concluded that the phone calls originated from a prison in Tamaulipas, although the sophisticated nature of this attack suggests that it involved a network of kidnappers between the states of Tamaulipas and Quintana Roo.

This case was a particularly complex example of a ‘virtual kidnapping’. These typically involve criminals calling random or carefully chosen targets, with the intention of tricking them into believing that they or one of their family members are being held hostage until they pay a ransom. A psychological game of threats, virtual kidnappings intimidate victims into isolating themselves from family and friends until a ransom is paid, even though they are not in any direct danger of being harmed. While virtual kidnapping is hardly new to Mexico or Latin America, having been around since mobile phones first became popular in the early 2000s, it attracted significant media reporting in Mexico in 2007 after criminals targeted several members of the lower chamber of the Mexican Congress as it was in session. Over the years, virtual kidnapping has become more sophisticated, with over 170,000 telephonic extortions now reported annually. Following a series of high-profile virtual kidnappings in 2013 and 2014, there is renewed interest in understanding how rapid advances in social media are shaping its evolution. In this regard, lax personal security measures exposing personal data, contact details, and travel plans on social media platforms, such as Facebook, Instagram, LinkedIn and WhatsApp, are enabling criminals to carry out more targeted virtual kidnapping attacks.

Mexico has the highest number of kidnapping and extortion incidents in Latin America, with 1,394 kidnapping and 6,139 extortion incidents having been reported in 2014. However, it is estimated that only two percent of incidents are officially reported due to widespread distrust in state security forces and fear of reprisals. As a result, independent reports put the total annual number of kidnapping and extortion cases at over 105,000 and 4,000,000 respectively every year. These figures exclude virtual kidnappings, which also largely go unreported. However, it is thought that approximately 84,000 cases take place every year. Organised criminal groups, including drug cartels, have historically been the primary perpetrators of traditional kidnapping in Mexico. Drug cartels are often portrayed as mafia-style groups, fighting each other in ceaseless violent turf wars. However, this stereotype belies the complexity of these organisations, as tech savvy cartels are already very active on social media, including YouTube, Facebook and Twitter. Similarly, virtual kidnappers have evolved from conducting simple cold-calling scams to targeted attacks involving national criminal networks. 

It is difficult to establish whether or not a cartel is involved in a virtual kidnapping, as criminals frequently claim to belong to drug cartels— particularly the widely-feared Los Zetas—for added psychological effect. Reports nevertheless suggest that virtual kidnappers often have ties to criminal organisations and that at least part of their revenue filters back to cartels. Authorities estimate that there are over 900 small criminal bands conducting virtual kidnappings in Mexico and that sophisticated virtual kidnapping attacks can involve six or more criminals. 

Facing growing domestic awareness of their illicit activities, virtual kidnapping gangs in Mexico have had to adapt their modus operandi. For years, state and federal government campaigns have warned domestic nationals about the risks of virtual kidnappings and have advised on the appropriate preventative measures. However, foreign embassies and ministries have been slow to react to the surge in these incidents, and foreign travellers and businesspeople remain largely unaware of the widespread virtual kidnapping threat in Mexico. In the past two years, virtual kidnappers and extortionists have thus shifted their focus to Spanish-speaking foreign nationals in search of potentially larger ransoms. For now, non-Spanish speakers are less likely to be targeted, as creating a believable kidnapping scenario relies heavily on successful communication between the perpetrator and victim over the phone. Recent incidents have targeted Colombian, Costa Rican, Venezuelan, Guatemalan, Spanish, and Spanish-speaking US nationals, with ransom demands ranging from USD 10,000 to USD 400,000. Many of these incidents have been traced back to prison inmates who managed to obtain the victim’s phone numbers, hotel locations, and personal information. According to a regionally-based representative of Terra Firma, many virtual kidnappings involve prison inmates working with ground operators who monitor tourist hotspots for potential victims. However, the Terra Firma representative also added that virtual kidnapping is a numbers game, relying on a high volume of attempts, suggesting that only a small percentage of attempts are successful.

Between June 2013 and February 2014, hotels nationwide reported an average of five to seven virtual kidnapping attempts per week. In perhaps the most high-profile incident to date, criminals claiming to be members of Los Zetas virtually kidnapped members of the Spanish rock band, Delorean, while they were on tour in Mexico City. The criminals persuaded the band to move hotels due to the alleged likelihood of a shootout, only to be told that they were being kidnapped once they had checked into their new accommodation. Deceived into believing that they were in imminent danger, the Delorean band members turned off their phones and locked themselves in their hotel rooms for 30 hours, during which time the perpetrators contacted the musicians’ families and demanded a USD 400,000 ransom. However, on this occasion, embassy staff and police informed the victims’ families of the elaborate scam before a ransom could be paid. Many hotels have now implemented training programmes for their employees that focus on preventing virtual kidnappings and telephonic extortion.

Government efforts to combat Mexico’s kidnapping epidemic, including the creation of an anti-kidnap unit known as the Fuerza Antisecuestro (FAS) in 2013, are unlikely to kerb incidents of virtual kidnapping or telephonic extortion, which continue to rise. Efforts to track phone calls and create a national registry of mobile phone users have also proven fruitless and counter-productive. Most extortionists use stolen phones and criminals have even been known to hack government phone registries. Criminals are also adept at utilising unregulated technology, with Mexico City police recently issuing an alert about a spike in virtual kidnappings carried out via WhatsApp, the mobile messaging service. Given these setbacks, the onus is largely on international firms operating in Mexico and Latin America to inform their personnel about the risk of virtual kidnapping. The responsibility for mitigation also rests with the individual to monitor what information they make available in the public domain, including photos, phone numbers, and business profiles. So beware - your next Facebook “Check-In” from Cancún may attract the attention of unwanted admirers.